Chapter 7: Auditing, Testing, and Monitoring

1. © 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Fundamentals of Information
Systems Security
Lesson 7
Auditing, Testing, and Monitoring

2. Page 2Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 2Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective(s)
 Explain the importance of security audits,
testing, and monitoring in an IT
infrastructure.

3. Page 3Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 3Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Key Concepts
 Practices and principles of security audits
 Ways to monitor systems
 Capturing and analyzing log data
 Assessing an organization’s security compliance
 Monitoring and testing security systems

4. Page 4Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 4Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Auditing, Testing, and Monitoring
 A security audit is a crucial type of evaluation to avoid
a data breach
 Auditing a computer system involves checking to see
how its operation has met security goals
 Audit tests may be manual or automated
 Before you can determine whether something has
worked, you must first define how it’s supposed to
work
• Known as assessing a system

5. Page 5Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 5Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Security Auditing and Analysis
Are security policies
sound and
appropriate for the
business or activity?
Are there controls
supporting your
policies?
Is there effective
implementation and
upkeep of controls?

6. Page 6Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 6Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Security Controls Address Risk

7. Page 7Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 7Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Determining What Is Acceptable
 Define acceptable and unacceptable actions
 Create standards based on those developed
or endorsed by standards bodies
 Communications and other actions permitted
by a policy document are acceptable
 Communications and other actions specifically
banned in your security policy are
unacceptable

8. Page 8Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 8Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Areas of Security Audits
Large in scope and
cover entire
departments or
business functions
Narrow and
address only one
specific system or
control

9. Page 9Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 9Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Purpose of Audits
Appropriateness of controls
• Is the level of security control suitable for the risk it
addresses?
Correct installation of controls
• Is the security control in the right place and working
well?
Address purpose of controls
• Is the security control effective in addressing the risk it
was designed to address?

10. Page 10Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 10Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Service Organization Control (SOC)
Reports
Report Type Contents Audience
SOC 1 Internal controls over
financial reporting
 Users and auditors
 Organizations that must
comply with SOX or the
GLBA
SOC 2 Security (confidentiality,
integrity, availability)
and privacy controls
 Management, regulators,
stakeholders
 Service providers, hosted
data centers, managed cloud
computing providers
SOC 3 Security (confidentiality,
integrity, availability)
and privacy controls
 Public
 Customers of SOC 2 service
providers

11. Page 11Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 11Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Defining Your Audit Plan
Define objectives;
determine which
systems or business
processes to review
Define which areas
of assurance to
check
Identify personnel
who will participate
in the audit

12. Page 12Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 12Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Defining the Scope of the Plan
Survey the site(s)
Review documentation
Review risk analysis output
Review server and application logs
Review incident logs
Review results of penetration tests

13. Page 13Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 13Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Audit Scope and the Seven Domains
of the IT Infrastructure

14. Page 14Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 14Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Auditing Benchmarks
Benchmark—The standard to which your
system is compared to determine whether
it is securely configured
• ISO 27002—ISO 27002
• NIST Cybersecurity Framework (CSF)
• ITIL (Information Technology Infrastructure Library)
• Control Objectives for Information and related Technology
(COBIT)
• Committee of Sponsoring Organizations (COSO)

15. Page 15Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 15Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Audit Data Collection Methods
Questionnaires Interviews Observation
Checklists
Reviewing
documentation
Reviewing
configurations
Reviewing
policy
Performing
security testing

16. Page 16Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 16Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Areas Included in Audit Plan
Area Audit Goal
Antivirus software Up-to-date, universal application
System access policies Current with technology
Intrusion detection and
event monitoring systems
Log reviews
System-hardening policies Ports, services
Cryptographic controls Key management, usage (network
encryption of sensitive data)
Contingency planning Business continuity plan (BCP),
disaster recovery plan (DRP), and
continuity of operations plan (COOP)

17. Page 17Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 17Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Areas Included in Audit Plan (cont.)
Area Audit Goal
Hardware and software
maintenance
Maintenance agreements,
servicing, forecasting of future
needs
Physical security Doors locked, power supplies
monitored
Access control Need to know, least privilege
Change control processes for
configuration management
Documented, no unauthorized
changes
Media protection Age of media, labeling, storage,
transportation

18. Page 18Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 18Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Control Checks and Identity
Management
 Approval process: Who grants approval for access
requests?
 Authentication mechanisms: What mechanisms are
used for specific security requirements?
 Password policy and enforcement: Does the
organization have an effective password policy and is it
uniformly enforced?
 Monitoring: Does the organization have sufficient
monitoring systems to detect unauthorized access?
 Remote access systems: Are all systems properly
secured with strong authentication?

19. Page 19Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 19Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Post-Audit Activities
 Exit interview
 Data analysis
 Generation of audit report
• Findings
• Recommendations
• Timeline for implementation
• Level of risk
• Management response
• Follow-up
 Presentation of findings

20. Page 20Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 20Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Security Monitoring
Baselines
Alarms, alerts, and trends
Closed-circuit TV
Systems that spot irregular behavior

21. Page 21Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 21Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Security Monitoring for Computer
Systems
• Host IDS
• System integrity monitoring
• Data loss prevention (DLP)
Real-time
monitoring
• Application logging
• System logging
Non-real-time
monitoring
• Host-based activity
• Network and network devicesLog activities

22. Page 22Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 22Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Types of Log Information to Capture
• General operating system and
application software eventsEvent logs
• Access requests to resourcesAccess logs
• Security-related eventsSecurity logs
• Defined events that provide
additional input to audit activitiesAudit logs

23. Page 23Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 23Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Types of Log Information

24. Page 24Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 24Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
How to Verify Security Controls
Controls that
monitor
activity
IDSs
IPSs
Firewalls

25. Page 25Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 25Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
IDS as a Firewall Complement

26. Page 26Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 26Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Basic NIDS as a Firewall
Complement

27. Page 27Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 27Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Analysis Methods
• Rule-based detection
• Rely on pattern matching and
stateful matching
Pattern- or
signature-based
IDSs
• Profile-based systems
Anomaly-based
IDSs
• Statistical-based methods
• Traffic-based methods
• Protocol patterns
Common methods
of detecting
anomalies

28. Page 28Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 28Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
HIDS
 Software processes or services designed to run on server
computers
 Intercept and examine system calls or specific processes
for patterns or behaviors that should not normally be
allowed
 HIDS daemons can take a predefined action such as
stopping or reporting the infraction
 Detect inappropriate traffic that originates inside the
network
 Recognize an anomaly that is specific to a particular
machine or user

29. Page 29Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 29Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Layered Defense: Network Access
Control

30. Page 30Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 30Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Using NIDS Devices to Monitor
Outside Attacks

31. Page 31Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 31Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Host Isolation and the DMZ

32. Page 32Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 32Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
System Hardening
 Turn off or disable unnecessary services; protect ones that
are still running
 Secure management interfaces and applications
 Protect passwords through aggressive password policies
 Disable unnecessary user accounts
 Apply the latest software patches available
 Secure all computers/devices from unauthorized changes
 Disable unused network interfaces
 Disable unused application service ports
 Use MAC filtering to limit device access
 Implement 802.1x, PNAC

33. Page 33Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 33Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Monitoring and Testing Security
Systems
Common risks are:
• Attackers who come in from outside, with
unauthorized access, malicious code,
Trojans, and malware
• Sensitive information leaking from inside
the organization to unauthorized people
who can damage your organization

34. Page 34Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 34Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Monitoring
Monitor traffic with an
IDS, which identifies
abnormal traffic for
further investigation
Use an IPS to
actively block
malicious traffic

35. Page 35Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 35Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Testing

36. Page 36Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 36Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Security Testing Road Map

37. Page 37Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 37Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Establishing Testing Goals and
Reconnaissance Methods
 Establish testing goals
• Identify vulnerabilities and rank them according to how
critical they are to your systems
• Document a point-in-time (snapshot) test for
comparison to other time periods
• Prepare for auditor review
• Find the gaps in your security
 Reconnaissance methods
• Social engineering
• Whois service
• Zone transfer

38. Page 38Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 38Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Network Mapping

39. Page 39Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 39Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Network Mapping with ICMP (Ping)

40. Page 40Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 40Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Network Mapping with TCP/SYN
Scans

41. Page 41Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 41Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Operating System Fingerprinting

42. Page 42Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 42Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Testing Methods
Black-box testing
• Uses test methods that aren’t based directly on
knowledge of a program’s architecture or design
White-box testing
• Is based on knowledge of the application’s design and
source code
Gray-box testing
• Lies somewhere between black-box testing and white-
box testing

43. Page 43Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 43Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Covert versus Overt Testers

44. Page 44Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 44Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Security Testing Tips and
Techniques
Choose the right tool
Tools make mistakes
Protect your systems
Tests should be as “real” as possible

45. Page 45Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 45Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
 Practices and principles of security audits
 Ways to monitor systems
 Capturing and analyzing log data
 Assessing an organization’s security
compliance
 Monitoring and testing security systems